Prototype Pollution Vulnerability in Node.js Package - CVE-2022-21824
Summary
UBUNTU-CVE-2022-21824: Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one proper... Affects nodejs versions < 12.22.9~dfsg-1ubuntu3. Fixed in 12.22.9~dfsg-1ubuntu3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine, enabling developers to build scalable network applications. It is widely used for server-side programming and offers a rich ecosystem of libraries and frameworks. The vulnerability in question affects specific versions of the Node.js package, which is essential for running JavaScript applications on the server. This vulnerability arises from the improper handling of user-controlled input in the 'console.table()' function, leading to potential prototype pollution.
Vulnerability Detail
The vulnerability, identified as CVE-2022-21824, originates from the formatting logic of the 'console.table()' function in Node.js. It allows user-controlled input to be passed to the 'properties' parameter while also passing a plain object with at least one property, such as 'proto'. This can lead to prototype pollution, where an attacker can manipulate the object prototype. Although the control is limited to assigning an empty string to numerical keys of the object prototype, it poses a risk of unexpected behavior in applications relying on the integrity of object prototypes. The affected versions include Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1.
How To Fix
Minimum fixed version
12.22.9~dfsg-1ubuntu3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can avoid passing user-controlled input directly to the 'properties' parameter of the 'console.table()' function. Instead, validate or sanitize the input before usage to prevent potential prototype pollution.
Conclusion
CVE-2022-21824 is a significant vulnerability affecting multiple versions of the Node.js package, allowing for prototype pollution through user-controlled input. It is crucial for developers to update their Node.js installations to the patched versions to ensure the security and integrity of their applications. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
CVE-2022-21824 is a vulnerability in Node.js that allows for prototype pollution through improper handling of user input in the 'console.table()' function.
The affected versions include Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The vulnerability can lead to unexpected behavior in applications by allowing an attacker to manipulate the object prototype, which may affect the integrity of the application.
Yes, patched versions of Node.js are available. It is recommended to update to the latest secure version to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
